Service Account Change Password

The Service Account change utility has 2 important functions - and while this utility is not needed very often, it saves about 20 minutes of time by providing a wizard interface for a Domain\System Administrator to make changes in these two specific areas by spending 30 seconds filling out some forms:

1. Change Service Account's password if this password needs to be changed (This article covers this procedure)
2. Change the service account to a different service account

The FileHold Server Application runs under a service account model, it has specific permissions, memberships and rights to run the FileHold Server application. This tool must be run by a domain administrator who also has access to the SQL databases, the FH Instrumentation tool uses Windows authentication to safeguard the process. It depends on the rights of the user running it.

• The service account can be a local account, or a domain account.
• It should not be an administrator or domain administrator level account
• It should have a strong password that complies with your domain security policy.
• It's password should not expire, nor should the account have the ability to change it's own password
• It must have SQL Server login permissions where the FileHold databases are stored and managed
  • It must be the DB Owner of all of the databases that are part of FileHold
• It must have Login as Service and Login as batch rights under the Local Security Policy.
• It must be a member of the IIS_IUSRS group
• It must run the FH App Pool in IIS 7.X
• It has specific settings in each of the FileHold web services
• It must have full control of the FileHoldData storage structure, specifically the:
  • DocumentRepository
  • FullTextSearch
  • FHURMBackups

All of this has to be set for the FH_Service account for the FileHold server to function properly.

Change Service Account's password - do this when users are not using the system, or notify them that there will be a few minutes of downtime. This procedure takes about 1-2 minutes at most.

• Launch the Change Service Account's password tool
•  Fill out the form as required

Procedure:

• Enter in the new password twice
• leave the scheduled task settings with "localhost" intact
• You will be connecting with your Windows Credentials so leave that intact. You can also use a SQL administrators credentials who is also a member of the Administrators group for this server, but if your system is synchronized with Active Directory then a Domain Admin with SQL administrator credentials will be needed.
• Enter in the path to the WebClient's LoginForm - using the example - add https if you are using SSL.
• Click Next - but don't click Update
• Stop the FH App Pool in IIS Admin
• ****** Change the password on the service account itself (in local user/group management or on the domain user and group management)
• Click Next to go to the Final page for the Action > Status page

• Click Update to start this process.
• Once completed - if all completed successfully, then click FINISH.
• Ensure that Account is unlocked in Active Directory or on local system
• Since the FH App Pool has been manually stopped, the status check will complain about this, simply start the FH App Pool if required
• Occasionally, the FileHold Workflow Host Service will not start - simply start it manually to address this

Finally:

• Restart WWW Service
• Restart FHURM Service
• Restart FH Workflow Host Service (if you are using this)
• Start the FH App Pool
• Login to FileHold with Web Client and Desktop Client
• Verify all scheduled tasks can run
  • (skip the AD Sync related task if your system is not synchronizing with Active Directory)

• Run the FileHold Health Checker Tool to validate the system is 100%

End of Procedure: